Here are eight Linux commands for looking into binary files and viewing details about what executables are doing when they run.

The ELF file that initiates the infection chain (AT&T) The encoding is performed using the polymorphic XOR additive feedback encoder ‘Shikata Ga Nai,’ previously analyzed by Mandiant.